FastMCP OAuth issuer redirection fix is opt-in despite patched SDK

Evidence record

Read the original source ↗

Claim-level citations (2)

• supportsFastMCP OAuth client credentials could follow attacker-advertised issuers: The FastMCP GHSA describes client-credentials and private-key-JWT provider wrappers lacking issuer binding; upgrading alone does not activate a configured issuer check where no issuer is supplied.

  M2M OAuth issuer-binding vulnerability; FastMCP 4.1.2 conditions; configuration limitation

• supportsFastMCP OAuth client credentials could follow attacker-advertised issuers: FastMCP 4.1.2 added issuer-bound M2M OAuth providers, but its maintainer states that callers must explicitly configure issuer; an upgrade alone leaves a compatibility mode that can still send secrets or signed assertions to attacker-advertised authorization servers.

  Maintainer assessment and remediation; affected 4.0.0a1–4.1.1; configuration required in 4.1.2